@sentry/junior 0.99.0 → 0.101.0

package/dist/app.js

@@ -5,7 +5,7 @@ import {
   processPluginTask,
   requireTurnFailureEventId,
   scheduleSessionCompletedPluginTasks
-} from "./chunk-ER45IV77.js";
+} from "./chunk-L2JIOAA2.js";
 import {
   buildSentryConversationUrl
 } from "./chunk-LVUKF5CE.js";
@@ -13,7 +13,7 @@ import {
   conversationVisibilityFromSlackChannelType,
   resolveSlackChannelTypeFromMessage,
   resolveSlackConversationContext
-} from "./chunk-NG2AV7IB.js";
+} from "./chunk-VVIXK2BX.js";
 import {
   CONVERSATION_WORK_CHECK_IN_INTERVAL_MS,
   CONVERSATION_WORK_STALE_ENQUEUE_MS,
@@ -37,7 +37,7 @@ import {
   requestConversationContinuation,
   requestConversationWork,
   startConversationWork
-} from "./chunk-NJEDJFK4.js";
+} from "./chunk-EBFJOOUE.js";
 import {
   GET
 } from "./chunk-QNVHH5PU.js";
@@ -86,6 +86,7 @@ import {
   formatProviderLabel,
   formatSlackLink,
   getConfigDefaults,
+  getMcpAuthSession,
   getMcpStoredOAuthCredentials,
   latestReportedProgress,
   listThreadReplies,
@@ -105,12 +106,11 @@ import {
   splitSlackReplyText,
   startOAuthFlow,
   truncateStatusText
-} from "./chunk-PYK7R5A7.js";
+} from "./chunk-UWGTSF5O.js";
 import {
   CooperativeTurnYieldError,
   TurnInputCommitLostError,
   TurnInputDeferredError,
-  applyPendingAuthUpdate,
   buildDeterministicTurnId,
   clearPendingAuth,
   coerceThreadArtifactsState,
@@ -134,24 +134,24 @@ import {
   persistWithRetry,
   persistYieldSessionRecord,
   startActiveTurn
-} from "./chunk-WJ7STXT6.js";
+} from "./chunk-XVR4O24H.js";
 import {
   JUNIOR_THREAD_STATE_TTL_MS,
   coerceThreadConversationState
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   abandonAgentTurnSessionRecord,
   failAgentTurnSessionRecord,
   getAgentTurnSessionRecord,
   listAgentTurnSessionSummariesForConversation,
   recordAgentTurnSessionSummary
-} from "./chunk-OL6XQ23W.js";
+} from "./chunk-IVXL57YF.js";
 import {
   commitMessages,
   loadConversationProjection,
   loadProjection,
   recordAuthorizationCompleted
-} from "./chunk-DHHU2WSG.js";
+} from "./chunk-IQIBZXGB.js";
 import {
   buildConversationContext,
   createConversationMemoryService,
@@ -166,8 +166,8 @@ import {
   persistConversationMessages,
   updateConversationStats,
   upsertConversationMessage
-} from "./chunk-IO65E4ZD.js";
-import "./chunk-H66UCBPW.js";
+} from "./chunk-JPQISMMJ.js";
+import "./chunk-XJA7BPHS.js";
 import "./chunk-PDO5BLNM.js";
 import "./chunk-CM5EZD5F.js";
 import {
@@ -179,7 +179,7 @@ import {
   setPlugins,
   validatePlugins,
   verifySlackDirectCredentialSubject
-} from "./chunk-FTTFV6DC.js";
+} from "./chunk-TPTJEHUE.js";
 import {
   SlackActionError,
   downloadPrivateSlackFile,
@@ -190,11 +190,11 @@ import {
   normalizeSlackConversationId,
   runWithSlackInstallationToken,
   runWithWorkspaceTeamId
-} from "./chunk-WTYEKPXU.js";
+} from "./chunk-FP5N5OWZ.js";
 import {
   createPluginLogger,
   createPluginState
-} from "./chunk-EOWXRY5E.js";
+} from "./chunk-PWC24W5F.js";
 import {
   contextProvenance,
   getConversationStore,
@@ -203,9 +203,8 @@ import {
   instructionProvenanceFor,
   juniorAgentSteps,
   juniorConversationMessages,
-  juniorConversations,
-  juniorDestinations
-} from "./chunk-OGHXZ4KQ.js";
+  juniorConversations
+} from "./chunk-VHRM6GNH.js";
 import "./chunk-G3E7SCME.js";
 import {
   sleep
@@ -233,7 +232,10 @@ import {
   setSlackReactionConfig,
   stripRuntimeTurnContext,
   trimTrailingAssistantMessages
-} from "./chunk-EEZCY5WX.js";
+} from "./chunk-A7X2FDUO.js";
+import {
+  juniorDestinations
+} from "./chunk-FXFQNHRU.js";
 import {
   parseSlackThreadId,
   readSlackRawMessageContext,
@@ -1153,7 +1155,7 @@ async function runAgentDispatchSlice(callback, deps) {
         modelId: reply.diagnostics.modelId,
         durationMs: reply.diagnostics.durationMs,
         usage: reply.diagnostics.usage,
-        reasoningLevel: reply.diagnostics.thinkingLevel,
+        reasoningLevel: reply.diagnostics.reasoningLevel,
         destination: dispatch.destination,
         source: dispatch.source,
         actor: dispatch.actor,
@@ -4495,6 +4497,11 @@ var CALLBACK_PAGES = {
     message: "Missing code parameter.",
     status: 400
   },
+  expired: {
+    title: "Authorization expired",
+    message: "This authorization link is no longer active. Return to Slack and retry the original request.",
+    status: 400
+  },
   success: {
     title: "Authorization complete",
     message: "Your MCP access is connected. Junior will continue the paused request in Slack.",
@@ -4506,6 +4513,12 @@ var CALLBACK_PAGES = {
     status: 500
   }
 };
+var McpOAuthAttemptExpiredError = class extends Error {
+  constructor() {
+    super("MCP OAuth authorization attempt is no longer current");
+    this.name = "McpOAuthAttemptExpiredError";
+  }
+};
 function mcpAuthorizationId(args) {
   return `${args.sessionId}:mcp:${args.provider}`;
 }
@@ -4595,20 +4608,19 @@ async function resumeAuthorizedMcpTurn(args) {
     provider,
     actorId: authSession.userId
   });
-  const resolvedSessionId = pendingAuth?.sessionId ?? authSession.sessionId;
+  if (pendingAuth?.authSessionId !== authSession.authSessionId) {
+    return;
+  }
+  const resolvedSessionId = pendingAuth.sessionId;
   const userMessage = getTurnUserMessage(conversation, resolvedSessionId);
-  if (pendingAuth) {
-    if (!isPendingAuthLatestRequest(conversation, pendingAuth)) {
-      clearPendingAuth(conversation, pendingAuth.sessionId);
-      await persistThreadStateById(threadId, { conversation });
-      await abandonAgentTurnSessionRecord({
-        conversationId: authSession.conversationId,
-        sessionId: pendingAuth.sessionId,
-        errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
-      });
-      return;
-    }
-  } else if (conversation.processing.activeTurnId !== authSession.sessionId) {
+  if (!isPendingAuthLatestRequest(conversation, pendingAuth)) {
+    clearPendingAuth(conversation, pendingAuth.sessionId);
+    await persistThreadStateById(threadId, { conversation });
+    await abandonAgentTurnSessionRecord({
+      conversationId: authSession.conversationId,
+      sessionId: pendingAuth.sessionId,
+      errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
+    });
     return;
   }
   if (!userMessage) {
@@ -4636,24 +4648,23 @@ async function resumeAuthorizedMcpTurn(args) {
         provider,
         actorId: authSession.userId
       });
-      const lockedSessionId = lockedPendingAuth?.sessionId ?? authSession.sessionId;
+      if (lockedPendingAuth?.authSessionId !== authSession.authSessionId) {
+        return false;
+      }
+      const lockedSessionId = lockedPendingAuth.sessionId;
       if (lockedSessionId !== resolvedSessionId) {
         return false;
       }
-      if (lockedPendingAuth) {
-        if (!isPendingAuthLatestRequest(lockedConversation, lockedPendingAuth)) {
-          clearPendingAuth(lockedConversation, lockedPendingAuth.sessionId);
-          await persistThreadStateById(threadId, {
-            conversation: lockedConversation
-          });
-          await abandonAgentTurnSessionRecord({
-            conversationId: authSession.conversationId,
-            sessionId: lockedPendingAuth.sessionId,
-            errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
-          });
-          return false;
-        }
-      } else if (lockedConversation.processing.activeTurnId !== authSession.sessionId) {
+      if (!isPendingAuthLatestRequest(lockedConversation, lockedPendingAuth)) {
+        clearPendingAuth(lockedConversation, lockedPendingAuth.sessionId);
+        await persistThreadStateById(threadId, {
+          conversation: lockedConversation
+        });
+        await abandonAgentTurnSessionRecord({
+          conversationId: authSession.conversationId,
+          sessionId: lockedPendingAuth.sessionId,
+          errorMessage: "Auth completed after a newer thread message abandoned this blocked request."
+        });
         return false;
       }
       const lockedUserMessage = getTurnUserMessage(
@@ -4753,11 +4764,7 @@ async function resumeAuthorizedMcpTurn(args) {
           },
           durability: {
             recordPendingAuth: async (nextPendingAuth) => {
-              await applyPendingAuthUpdate({
-                conversation: lockedConversation,
-                conversationId: authSession.conversationId,
-                nextPendingAuth
-              });
+              lockedConversation.processing.pendingAuth = nextPendingAuth;
               await persistThreadStateById(threadId, {
                 conversation: lockedConversation
               });
@@ -4822,6 +4829,43 @@ async function resumeAuthorizedMcpTurn(args) {
     }
   });
 }
+async function isCurrentMcpAuthorizationAttempt(authSession, provider) {
+  if (!authSession.channelId || !authSession.threadTs) {
+    return false;
+  }
+  const threadId = `slack:${authSession.channelId}:${authSession.threadTs}`;
+  const currentState = await getPersistedThreadState(threadId);
+  const conversation = coerceThreadConversationState(currentState);
+  const pendingAuth = getConversationPendingAuth({
+    conversation,
+    kind: "mcp",
+    provider,
+    actorId: authSession.userId
+  });
+  return pendingAuth?.authSessionId === authSession.authSessionId && pendingAuth.sessionId === authSession.sessionId;
+}
+async function runCurrentMcpCredentialMutation(authSession, provider, mutation) {
+  if (!authSession.channelId || !authSession.threadTs) {
+    throw new McpOAuthAttemptExpiredError();
+  }
+  const threadId = `slack:${authSession.channelId}:${authSession.threadTs}`;
+  const stateAdapter = getStateAdapter();
+  await stateAdapter.connect();
+  const lock = await acquireActiveLock(stateAdapter, threadId);
+  if (!lock) {
+    throw new Error(
+      `Could not acquire MCP OAuth callback lock for ${threadId}`
+    );
+  }
+  try {
+    if (!await isCurrentMcpAuthorizationAttempt(authSession, provider)) {
+      throw new McpOAuthAttemptExpiredError();
+    }
+    return await mutation();
+  } finally {
+    await stateAdapter.releaseLock(lock);
+  }
+}
 async function GET4(request, provider, waitUntil, options) {
   const url = new URL(request.url);
   const state = url.searchParams.get("state")?.trim();
@@ -4837,7 +4881,23 @@ async function GET4(request, provider, waitUntil, options) {
     return htmlResponse("missing_code");
   }
   try {
-    const authSession = await finalizeMcpAuthorization(provider, state, code);
+    const pendingSession = await getMcpAuthSession(state);
+    if (!pendingSession || pendingSession.provider !== provider || !await isCurrentMcpAuthorizationAttempt(pendingSession, provider)) {
+      if (pendingSession) {
+        await deleteMcpAuthSession(pendingSession.authSessionId);
+      }
+      return htmlResponse("expired");
+    }
+    const authSession = await finalizeMcpAuthorization(
+      provider,
+      state,
+      code,
+      async (mutation) => await runCurrentMcpCredentialMutation(
+        pendingSession,
+        provider,
+        mutation
+      )
+    );
     try {
       await deleteMcpAuthSession(authSession.authSessionId);
     } catch (cleanupError) {
@@ -4858,6 +4918,10 @@ async function GET4(request, provider, waitUntil, options) {
     );
     return htmlResponse("success");
   } catch (callbackError) {
+    if (callbackError instanceof McpOAuthAttemptExpiredError) {
+      await deleteMcpAuthSession(state);
+      return htmlResponse("expired");
+    }
     logException(
       callbackError,
       "mcp_oauth_callback_failed",
@@ -5302,11 +5366,7 @@ async function resumeOAuthSessionRecordTurn(stored, options) {
           },
           durability: {
             recordPendingAuth: async (nextPendingAuth) => {
-              await applyPendingAuthUpdate({
-                conversation: lockedConversation,
-                conversationId: stored.resumeConversationId,
-                nextPendingAuth
-              });
+              lockedConversation.processing.pendingAuth = nextPendingAuth;
               await persistThreadStateById(stored.resumeConversationId, {
                 conversation: lockedConversation
               });
@@ -10106,11 +10166,7 @@ function createReplyToThread(deps) {
                 });
               },
               recordPendingAuth: async (pendingAuth) => {
-                await applyPendingAuthUpdate({
-                  conversation: preparedState.conversation,
-                  conversationId,
-                  nextPendingAuth: pendingAuth
-                });
+                preparedState.conversation.processing.pendingAuth = pendingAuth;
                 await persistThreadState(thread, {
                   conversation: preparedState.conversation
                 });
@@ -10304,7 +10360,7 @@ function createReplyToThread(deps) {
                 conversationId,
                 durationMs: reply.diagnostics.durationMs,
                 usage: reply.diagnostics.usage,
-                reasoningLevel: reply.diagnostics.thinkingLevel,
+                reasoningLevel: reply.diagnostics.reasoningLevel,
                 destination,
                 destinationVisibility,
                 source,
@@ -11198,11 +11254,7 @@ async function continueSlackAgentRun(payload, options) {
             },
             durability: {
               recordPendingAuth: async (nextPendingAuth) => {
-                await applyPendingAuthUpdate({
-                  conversation,
-                  conversationId: payload.conversationId,
-                  nextPendingAuth
-                });
+                conversation.processing.pendingAuth = nextPendingAuth;
                 await persistThreadStateById(payload.conversationId, {
                   conversation
                 });
@@ -11674,9 +11726,11 @@ function dashboardHostRoutePaths(dashboard) {
     basePath,
     conversationsPath,
     `${conversationsPath}/*`,
+    pagePath("locations"),
+    `${pagePath("locations")}/*`,
     peoplePath,
     `${peoplePath}/*`,
-    pagePath("plugins")
+    pagePath("system")
   ];
   const loginPath = basePath === "/" ? "/auth/login" : `${basePath}/auth/login`;
   return [
@@ -11692,6 +11746,8 @@ function dashboardHostRoutePaths(dashboard) {
     "/api/skills",
     "/api/conversations",
     "/api/conversations/*",
+    "/api/locations",
+    "/api/locations/*",
     "/api/people",
     "/api/people/*",
     "/api/config",

package/dist/chat/agent/request.d.ts

@@ -22,6 +22,7 @@ import type { ConversationPendingAuthState } from "@/chat/state/conversation";
 import type { PiMessageProvenance } from "@/chat/state/session-log";
 import type { AgentTurnSurface } from "@/chat/state/turn-session";
 import type { ToolExecutionReport } from "@/chat/tool-support/tool-execution-report";
+import type { TurnReasoningLevel } from "@/chat/reasoning-level";
 import type { ImageGenerateToolDeps, WebFetchToolDeps, WebSearchToolDeps } from "@/chat/tools/types";
 export interface AgentRunAttachment {
     data?: Buffer;
@@ -89,6 +90,8 @@ export interface AgentRunPolicy {
     /** Cancels provider work when the owning host request is abandoned. */
     signal?: AbortSignal;
     authorizationFlowMode?: AuthorizationFlowMode;
+    /** Explicit per-agent reasoning level. When set, adaptive routing is disabled. */
+    reasoningLevel?: TurnReasoningLevel;
     configuration?: Record<string, unknown>;
     channelConfiguration?: ChannelConfigurationService;
     skillDirs?: string[];
@@ -130,7 +133,7 @@ export interface AgentRunDurability {
     /** Return true when the durable worker should pause at the next Pi boundary. */
     shouldYield?: () => boolean;
     drainSteeringMessages?: (accept: (messages: AgentRunSteeringMessage[]) => Promise<void>) => Promise<AgentRunSteeringMessage[]>;
-    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState) => void | Promise<void>;
+    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState | undefined) => void | Promise<void>;
     onSandboxAcquired?: (sandbox: SandboxAcquiredState) => void | Promise<void>;
     onArtifactStateUpdated?: (artifactState: ThreadArtifactsState) => void | Promise<void>;
 }

package/dist/chat/config.d.ts

@@ -1,3 +1,4 @@
+import { type TurnReasoningLevel } from "@/chat/reasoning-level";
 /**
  * Buffer between the Vercel function timeout and the agent turn timeout so
  * Junior can abort, persist, and schedule continuation before host teardown.
@@ -9,6 +10,7 @@ export interface BotConfig {
     loadingMessages: string[];
     modelId: string;
     modelProfiles: Readonly<Record<string, string>>;
+    reasoningLevel?: TurnReasoningLevel;
     modelContextWindowTokens?: number;
     visionModelId?: string;
     turnTimeoutMs: number;

package/dist/chat/conversations/store.d.ts

@@ -26,7 +26,7 @@ export interface Conversation {
     /**
      * When retention purged this conversation's content. Set means messages and
      * steps were deleted wholesale; reporting presents the transcript as expired
-     * rather than privacy-redacted (`../../../specs/data-redaction-policy.md`).
+     * rather than privacy-redacted (`../../../../../policies/data-redaction.md`).
      */
     transcriptPurgedAtMs?: number;
     /** Persisted destination visibility. Undefined means no destination row exists. */

package/dist/chat/mcp/auth-store.d.ts

@@ -3,6 +3,7 @@ import type { OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.
 import { type Destination, type Source } from "@sentry/junior-plugin-api";
 import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 export interface McpAuthSessionState {
+    schemaVersion: 2;
     authSessionId: string;
     provider: string;
     userId: string;

package/dist/chat/mcp/client.d.ts

@@ -15,6 +15,7 @@ export declare class PluginMcpClient {
     private readonly plugin;
     private readonly options;
     private client?;
+    private clientPromise?;
     private lastAttemptedTransportSessionId?;
     private transport?;
     private listedTools?;
@@ -24,6 +25,7 @@ export declare class PluginMcpClient {
     close(): Promise<void>;
     private withSessionRecovery;
     private getClient;
+    private connectClient;
     private wrapAuth;
     private shouldResetMissingSession;
     private disposeClient;

package/dist/chat/mcp/oauth-provider.d.ts

@@ -5,8 +5,9 @@ export declare class StateBackedMcpOAuthClientProvider implements OAuthClientPro
     readonly authSessionId: string;
     private readonly callbackUrl;
     private readonly sessionContext?;
+    private readonly runCredentialMutation?;
     readonly clientMetadata: OAuthClientMetadata;
-    constructor(authSessionId: string, callbackUrl: string, sessionContext?: Omit<McpAuthSessionState, "authSessionId" | "authorizationUrl" | "codeVerifier" | "createdAtMs" | "updatedAtMs"> | undefined);
+    constructor(authSessionId: string, callbackUrl: string, sessionContext?: Omit<McpAuthSessionState, "schemaVersion" | "authSessionId" | "authorizationUrl" | "codeVerifier" | "createdAtMs" | "updatedAtMs"> | undefined, runCredentialMutation?: (<T>(mutation: () => Promise<T>) => Promise<T>) | undefined);
     get redirectUrl(): string;
     state(): Promise<string>;
     clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
@@ -21,6 +22,8 @@ export declare class StateBackedMcpOAuthClientProvider implements OAuthClientPro
     invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
     getMcpServerSessionId(): Promise<string | undefined>;
     saveMcpServerSessionId(sessionId: string | undefined): Promise<void>;
+    /** Route shared credential writes through callback-owned freshness control. */
+    private mutateCredentials;
     private getCredentialContext;
     private ensureSession;
     private requireSession;

package/dist/chat/mcp/oauth.d.ts

@@ -3,6 +3,7 @@ import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 import { type McpAuthSessionState } from "./auth-store";
 import { StateBackedMcpOAuthClientProvider } from "./oauth-provider";
 export declare function getMcpOAuthCallbackPath(provider: string): string;
+/** Create one immutable provider authorization attempt for the active turn. */
 export declare function createMcpOAuthClientProvider(input: {
     provider: string;
     conversationId: string;
@@ -17,4 +18,5 @@ export declare function createMcpOAuthClientProvider(input: {
     configuration?: Record<string, unknown>;
     artifactState?: ThreadArtifactsState;
 }): Promise<StateBackedMcpOAuthClientProvider>;
-export declare function finalizeMcpAuthorization(provider: string, authSessionId: string, authorizationCode: string): Promise<McpAuthSessionState>;
+/** Exchange a callback code while guarding every shared credential mutation. */
+export declare function finalizeMcpAuthorization(provider: string, authSessionId: string, authorizationCode: string, runCredentialMutation?: <T>(mutation: () => Promise<T>) => Promise<T>): Promise<McpAuthSessionState>;

package/dist/chat/mcp/tool-manager.d.ts

@@ -43,6 +43,7 @@ export declare class McpToolManager {
     private readonly activeProviders;
     private readonly authorizationPendingProviders;
     private readonly clientsByProvider;
+    private readonly clientPromisesByProvider;
     private readonly toolsByProvider;
     constructor(plugins: PluginDefinition[], options?: McpToolManagerOptions);
     getActiveProviders(): string[];
@@ -61,6 +62,7 @@ export declare class McpToolManager {
     }): ManagedMcpToolDescriptor[];
     private filterListedTools;
     private getClient;
+    private createClient;
     private toManagedTool;
     private handleAuthorizationRequired;
     /** Return all active ManagedMcpTool objects, optionally filtered by provider. */

package/dist/chat/reasoning-level.d.ts

@@ -0,0 +1,4 @@
+export declare const TURN_REASONING_LEVELS: readonly ["none", "low", "medium", "high", "xhigh"];
+export type TurnReasoningLevel = (typeof TURN_REASONING_LEVELS)[number];
+/** Validate a configured main-agent reasoning level. */
+export declare function parseTurnReasoningLevel(value: unknown): TurnReasoningLevel;

package/dist/chat/services/mcp-auth-orchestration.d.ts

@@ -30,7 +30,7 @@ export interface McpAuthOrchestrationInput {
     getConfiguration: () => Record<string, unknown>;
     getArtifactState: () => ThreadArtifactsState | undefined;
     getMergedArtifactState: () => ThreadArtifactsState;
-    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState) => void | Promise<void>;
+    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState | undefined) => void | Promise<void>;
     authorizationFlowMode?: AuthorizationFlowMode;
 }
 export interface McpAuthOrchestration {

package/dist/chat/services/pending-auth.d.ts

@@ -10,22 +10,30 @@ export declare function canReusePendingAuthLink(args: {
     scope?: string;
     sessionId: string;
 }): boolean;
+/** Return the exact pending authorization target for one actor and provider. */
 export declare function getConversationPendingAuth(args: {
     conversation: ThreadConversationState;
-    kind: AuthorizationPauseKind;
+    kind: "mcp";
     provider: string;
     actorId: string;
     scope?: string;
-}): ConversationPendingAuthState | undefined;
-export declare function clearPendingAuth(conversation: ThreadConversationState, sessionId?: string): void;
-/**
- * Apply a new pending-auth record to the conversation and, when replacing a
- * different session's pending-auth, mark the prior session record as abandoned.
- * Callers are responsible for persisting the mutated conversation afterwards.
- */
-export declare function applyPendingAuthUpdate(args: {
+}): Extract<ConversationPendingAuthState, {
+    kind: "mcp";
+}> | undefined;
+export declare function getConversationPendingAuth(args: {
     conversation: ThreadConversationState;
+    kind: "plugin";
+    provider: string;
+    actorId: string;
+    scope?: string;
+}): Extract<ConversationPendingAuthState, {
+    kind: "plugin";
+}> | undefined;
+export declare function clearPendingAuth(conversation: ThreadConversationState, sessionId?: string): void;
+/** Mark the prior blocked turn abandoned after a new auth attempt replaces it. */
+export declare function abandonReplacedPendingAuth(args: {
     conversationId: string | undefined;
+    previousPendingAuth: ConversationPendingAuthState | undefined;
     nextPendingAuth: ConversationPendingAuthState;
 }): Promise<void>;
 /**

package/dist/chat/services/{turn-thinking-level.d.ts → turn-reasoning-level.d.ts}

@@ -1,9 +1,9 @@
 import type { ThinkingLevel as AgentThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { ThinkingLevel as ProviderThinkingLevel } from "@earendil-works/pi-ai";
 import { z } from "zod";
-declare const TURN_THINKING_LEVELS: readonly ["none", "low", "medium", "high", "xhigh"];
+import { type TurnReasoningLevel } from "@/chat/reasoning-level";
 declare const turnExecutionProfileSchema: z.ZodObject<{
-    thinking_level: z.ZodEnum<{
+    reasoning_level: z.ZodEnum<{
         low: "low";
         medium: "medium";
         high: "high";
@@ -13,14 +13,15 @@ declare const turnExecutionProfileSchema: z.ZodObject<{
     confidence: z.ZodPreprocess<z.ZodNumber>;
     reason: z.ZodString;
 }, z.core.$strip>;
-type TurnThinkingLevel = (typeof TURN_THINKING_LEVELS)[number];
-export interface TurnThinkingSelection {
+export interface TurnReasoningSelection {
     confidence?: number;
-    thinkingLevel: TurnThinkingLevel;
+    reasoningLevel: TurnReasoningLevel;
     reason: string;
 }
-/** Choose the thinking level for the upcoming assistant turn. */
-export declare function selectTurnThinkingLevel(args: {
+/** Preserve an explicitly configured reasoning level without invoking the router. */
+export declare function configuredTurnReasoningLevel(reasoningLevel: TurnReasoningLevel, source: "agent_config" | "default"): TurnReasoningSelection;
+/** Choose the reasoning level for the upcoming assistant turn when none is configured. */
+export declare function selectTurnReasoningLevel(args: {
     completeObject: (args: {
         modelId: string;
         schema: typeof turnExecutionProfileSchema;
@@ -43,7 +44,7 @@ export declare function selectTurnThinkingLevel(args: {
     currentTurnBlocks?: string[];
     fastModelId: string;
     messageText: string;
-}): Promise<TurnThinkingSelection>;
-/** Convert a routing bucket into the Pi Agent thinking level for a main turn. */
-export declare function toAgentThinkingLevel(level: TurnThinkingSelection["thinkingLevel"]): AgentThinkingLevel | "off";
+}): Promise<TurnReasoningSelection>;
+/** Convert a routing bucket into the Pi Agent reasoning setting for a main turn. */
+export declare function toPiReasoningLevel(level: TurnReasoningSelection["reasoningLevel"]): AgentThinkingLevel | "off";
 export {};

package/dist/chat/services/turn-result.d.ts

@@ -1,6 +1,6 @@
 import type { LogContext } from "@/chat/logging";
 import type { PiMessage } from "@/chat/pi/messages";
-import type { TurnThinkingSelection } from "@/chat/services/turn-thinking-level";
+import type { TurnReasoningSelection } from "@/chat/services/turn-reasoning-level";
 import type { AgentTurnUsage } from "@/chat/usage";
 import type { ReplyDeliveryPlan } from "@/chat/services/reply-delivery-plan";
 import type { ThreadArtifactsState } from "@/chat/state/artifacts";
@@ -11,7 +11,7 @@ export interface AgentTurnDiagnostics {
     providerError?: unknown;
     modelId: string;
     outcome: "success" | "execution_failure" | "provider_error";
-    thinkingLevel?: TurnThinkingSelection["thinkingLevel"];
+    reasoningLevel?: TurnReasoningSelection["reasoningLevel"];
     stopReason?: string;
     toolCalls: string[];
     toolErrorCount: number;
@@ -42,7 +42,7 @@ export interface TurnResultInput {
     shouldTrace: boolean;
     spanContext: LogContext;
     usage?: AgentTurnUsage;
-    thinkingSelection: TurnThinkingSelection;
+    reasoningSelection: TurnReasoningSelection;
     correlation?: {
         threadId?: string;
         actorId?: string;